.jpg?1757614389){kind=logo}
- Remote, Europe
- Remote
- Full-time · Mid
Make priority threats visible and actionable by building, testing and tuning detections for attacker behaviour and control failures, and developing reliable workflows that enrich and route investigation evidence.
Responsibilities
- Develop, test, tune and maintain SIEM/EDR detections for assigned priority attacker behaviours and control failures within the detection standards, using evidence to reduce false positives while preserving required coverage.
- Document detection logic, assumptions, limitations, owners, test evidence, runbooks and expected analyst actions.
- Build low-risk automations for triage, enrichment, routing, evidence collection and reporting, with approvals, access controls, logging, failure handling and rollback; validate with SOC, IR and domain owners before operational use.
- Monitor the reliability of assigned detections and workflows, diagnose failures, and maintain documentation and recovery steps.
- Approve rule logic and tuning changes that conform to the detection standards, and low-risk enrichment/routing changes within delegated automation authority; escalate deviations to the detection manager and submit response automations and integrations through the required approval path.
Requirements
- Nice to have: Detection-as-code
- Nice to have: version control
- Nice to have: peer review
- Nice to have: automated rule testing
- Nice to have: continuous-integration practices